Bookshelf
Security books, adjacent thinking, and the concepts that improve how defenders reason and communicate.
Personal reading notes, not affiliate recommendations.
A useful bridge between intelligence practice and the operational reality of incident response.
Key idea: indicators describe artifacts; adversary behavior provides context that can improve both investigation and future detection.
A foundation for thinking about visibility, evidence, and network-centric investigation.
Key idea: collection is valuable only when it supports analysis, escalation, and a repeatable response process.
A compact model for understanding which detections create the greatest cost for an adversary.
Key idea: detections based on tools, techniques, and behavior tend to be more durable than atomic indicators.
Not a security book, but a powerful guide to feedback, structure, and unintended consequences.
Key idea: defensive outcomes emerge from incentives, delays, workflows, and feedback loops—not isolated controls.